Malware Analysis Report

2024-11-30 16:02

Sample ID 220707-mds8saegg5
Target 45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830
SHA256 45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830
Tags
imminent spyware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830

Threat Level: Known bad

The file 45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830 was found to be: Known bad.

Malicious Activity Summary

imminent spyware trojan

Imminent RAT

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Deletes itself

Drops desktop.ini file(s)

Drops file in Windows directory

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: GetForegroundWindowSpam

Runs ping.exe

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-07-07 10:21

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2022-07-07 10:21

Reported

2022-07-07 11:18

Platform

win10v2004-20220414-en

Max time kernel

151s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830.exe"

Signatures

Imminent RAT

trojan spyware imminent

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830.exe N/A

Enumerates physical storage devices

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4552 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830.exe C:\Users\Admin\AppData\Local\Temp\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830.exe
PID 4552 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830.exe C:\Users\Admin\AppData\Local\Temp\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830.exe
PID 4552 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830.exe C:\Users\Admin\AppData\Local\Temp\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830.exe
PID 4552 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830.exe C:\Windows\SysWOW64\cmd.exe
PID 4552 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830.exe C:\Windows\SysWOW64\cmd.exe
PID 4552 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830.exe C:\Windows\SysWOW64\cmd.exe
PID 1936 wrote to memory of 2764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1936 wrote to memory of 2764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1936 wrote to memory of 2764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830.exe

"C:\Users\Admin\AppData\Local\Temp\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830.exe"

C:\Users\Admin\AppData\Local\Temp\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830.exe

"C:\Users\Admin\AppData\Local\Temp\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830.exe"

C:\Windows\SysWOW64\PING.EXE

ping 1.1.1.1 -n 1 -w 1000

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 solarintel.linkpc.net udp
US 192.254.74.210:9009 solarintel.linkpc.net tcp
US 192.254.74.210:9009 solarintel.linkpc.net tcp
FR 2.18.109.224:443 tcp
US 192.254.74.210:9009 solarintel.linkpc.net tcp
US 192.254.74.210:9009 solarintel.linkpc.net tcp
US 192.254.74.210:9009 solarintel.linkpc.net tcp
US 192.254.74.210:9009 solarintel.linkpc.net tcp
IE 13.69.239.73:443 tcp
US 104.18.25.243:80 tcp
US 192.254.74.210:9009 solarintel.linkpc.net tcp
US 192.254.74.210:9009 solarintel.linkpc.net tcp
NL 104.110.191.140:80 tcp
NL 104.110.191.140:80 tcp
US 209.197.3.8:80 tcp
US 192.254.74.210:9009 solarintel.linkpc.net tcp
US 192.254.74.210:9009 solarintel.linkpc.net tcp
US 192.254.74.210:9009 solarintel.linkpc.net tcp
US 192.254.74.210:9009 solarintel.linkpc.net tcp
US 192.254.74.210:9009 solarintel.linkpc.net tcp
US 93.184.220.29:80 tcp
US 192.254.74.210:9009 solarintel.linkpc.net tcp
US 192.254.74.210:9009 solarintel.linkpc.net tcp
US 192.254.74.210:9009 solarintel.linkpc.net tcp
US 192.254.74.210:9009 solarintel.linkpc.net tcp
US 192.254.74.210:9009 solarintel.linkpc.net tcp
US 192.254.74.210:9009 solarintel.linkpc.net tcp
US 192.254.74.210:9009 solarintel.linkpc.net tcp
US 192.254.74.210:9009 solarintel.linkpc.net tcp
US 192.254.74.210:9009 solarintel.linkpc.net tcp
US 192.254.74.210:9009 solarintel.linkpc.net tcp
US 192.254.74.210:9009 solarintel.linkpc.net tcp
US 192.254.74.210:9009 solarintel.linkpc.net tcp
US 192.254.74.210:9009 solarintel.linkpc.net tcp
US 192.254.74.210:9009 solarintel.linkpc.net tcp
US 192.254.74.210:9009 solarintel.linkpc.net tcp
US 192.254.74.210:9009 solarintel.linkpc.net tcp
US 192.254.74.210:9009 solarintel.linkpc.net tcp
US 192.254.74.210:9009 solarintel.linkpc.net tcp

Files

memory/4552-130-0x0000000074F90000-0x0000000075541000-memory.dmp

memory/2576-131-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830.exe

MD5 1b3ff3c18f3eb9fa35c08dd658ce17be
SHA1 0156aee32459f6adf75f0d617fa0df035c76bc64
SHA256 45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830
SHA512 365f98145695aedb914c4757215d8cad8b2bbc088e7589e1d74e0aaca8d6812b4f7e19515d3bd92f0e085e2e1137bc6b10eca7dfd3034798f264d70c8ea6d8a6

C:\Users\Admin\AppData\Local\Temp\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830.exe

MD5 1b3ff3c18f3eb9fa35c08dd658ce17be
SHA1 0156aee32459f6adf75f0d617fa0df035c76bc64
SHA256 45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830
SHA512 365f98145695aedb914c4757215d8cad8b2bbc088e7589e1d74e0aaca8d6812b4f7e19515d3bd92f0e085e2e1137bc6b10eca7dfd3034798f264d70c8ea6d8a6

memory/1936-134-0x0000000000000000-mapping.dmp

memory/2764-135-0x0000000000000000-mapping.dmp

memory/4552-136-0x0000000074F90000-0x0000000075541000-memory.dmp

memory/2576-137-0x0000000074F90000-0x0000000075541000-memory.dmp

memory/2576-138-0x0000000074F90000-0x0000000075541000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2022-07-07 10:21

Reported

2022-07-07 11:18

Platform

win7-20220414-en

Max time kernel

37s

Max time network

43s

Command Line

"C:\Users\Admin\AppData\Local\Temp\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830.exe"

Signatures

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Enumerates physical storage devices

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2036 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Local\Temp\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830.exe C:\Users\Admin\AppData\Local\Temp\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830.exe
PID 2036 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Local\Temp\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830.exe C:\Users\Admin\AppData\Local\Temp\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830.exe
PID 2036 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Local\Temp\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830.exe C:\Users\Admin\AppData\Local\Temp\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830.exe
PID 2036 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Local\Temp\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830.exe C:\Users\Admin\AppData\Local\Temp\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830.exe
PID 2036 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Local\Temp\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830.exe C:\Windows\SysWOW64\cmd.exe
PID 2036 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Local\Temp\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830.exe C:\Windows\SysWOW64\cmd.exe
PID 2036 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Local\Temp\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830.exe C:\Windows\SysWOW64\cmd.exe
PID 2036 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Local\Temp\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830.exe C:\Windows\SysWOW64\cmd.exe
PID 1564 wrote to memory of 1868 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1564 wrote to memory of 1868 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1564 wrote to memory of 1868 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1564 wrote to memory of 1868 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830.exe

"C:\Users\Admin\AppData\Local\Temp\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830.exe"

C:\Users\Admin\AppData\Local\Temp\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830.exe

"C:\Users\Admin\AppData\Local\Temp\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830.exe"

C:\Windows\SysWOW64\PING.EXE

ping 1.1.1.1 -n 1 -w 1000

Network

N/A

Files

memory/2036-54-0x0000000075C01000-0x0000000075C03000-memory.dmp

memory/2036-55-0x00000000748A0000-0x0000000074E4B000-memory.dmp

memory/2036-56-0x00000000748A0000-0x0000000074E4B000-memory.dmp

\Users\Admin\AppData\Local\Temp\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830.exe

MD5 1b3ff3c18f3eb9fa35c08dd658ce17be
SHA1 0156aee32459f6adf75f0d617fa0df035c76bc64
SHA256 45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830
SHA512 365f98145695aedb914c4757215d8cad8b2bbc088e7589e1d74e0aaca8d6812b4f7e19515d3bd92f0e085e2e1137bc6b10eca7dfd3034798f264d70c8ea6d8a6

memory/1376-59-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830.exe

MD5 1b3ff3c18f3eb9fa35c08dd658ce17be
SHA1 0156aee32459f6adf75f0d617fa0df035c76bc64
SHA256 45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830
SHA512 365f98145695aedb914c4757215d8cad8b2bbc088e7589e1d74e0aaca8d6812b4f7e19515d3bd92f0e085e2e1137bc6b10eca7dfd3034798f264d70c8ea6d8a6

\Users\Admin\AppData\Local\Temp\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830.exe

MD5 1b3ff3c18f3eb9fa35c08dd658ce17be
SHA1 0156aee32459f6adf75f0d617fa0df035c76bc64
SHA256 45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830
SHA512 365f98145695aedb914c4757215d8cad8b2bbc088e7589e1d74e0aaca8d6812b4f7e19515d3bd92f0e085e2e1137bc6b10eca7dfd3034798f264d70c8ea6d8a6

C:\Users\Admin\AppData\Local\Temp\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830\45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830.exe

MD5 1b3ff3c18f3eb9fa35c08dd658ce17be
SHA1 0156aee32459f6adf75f0d617fa0df035c76bc64
SHA256 45efa7e450e1bfab0140dcefc29b494ca834ac539e0550d7543c56010328a830
SHA512 365f98145695aedb914c4757215d8cad8b2bbc088e7589e1d74e0aaca8d6812b4f7e19515d3bd92f0e085e2e1137bc6b10eca7dfd3034798f264d70c8ea6d8a6

memory/1376-63-0x00000000748A0000-0x0000000074E4B000-memory.dmp

memory/1564-64-0x0000000000000000-mapping.dmp

memory/2036-65-0x00000000748A0000-0x0000000074E4B000-memory.dmp

memory/1868-66-0x0000000000000000-mapping.dmp